Researchers show Diebold voting machines unsecure, citizens shocked

We're all for hacking stuff, generally, but hacking democracy for malicious purposes is just plain uncool. While no one's definitively proven that such a scenario has ever actually happened in real elections, vote-hacking remains a distinct possibility, given the state of our electronic voting equipment. If you were unconvinced the last time we covered this, of just how shoddy these Diebold voting machines are, here's another arrow in our quiver: Princeton University researchers have taken apart a Diebold machine, examined it from every angle, written a new paper on its flaws and have come to the following conclusions: 1) Malicious code "can steal votes with little if any risk of detection." 2) Said code can be installed in one minute or less. 3) The Dieblod machines run Windows CE 3.0 -- so, they're susceptible to viruses. 4) Some problems would require the entire replacing of hardware, yet another security risk. Still though, we would love to see a debate between the two candidates in this fictitious election: George Washington and Benedict Arnold.

[Via Boing Boing]

[pbase @ Sep 14th 2006 3:32AM]

Nothing surprising here. After the manufacturer of these machines, with a nod and a wink, guaranteed the GOP a victory last November. What's amazing is that it took so long for someone to dissect one of these.

[Ihar `Philips` Filipau @ Sep 14th 2006 3:53AM]

Why aussies can do it - while best democracy money can buy - cannot?

[bill purser @ Feb 29th 2008 9:09PM]

nancy palosi's constituents,the vast majority of which do not think like her,shold oust her in coming election.she has a littany of conflict of interest.plus she has sided with the most abominable people ever to occupy the white house.this strutting would be dictator should be hanged for treason.likewise the vice president sincerely bill purser

[PacketMonkee @ Sep 14th 2006 4:01AM]

I never liked the name of these things.. Diebold? WTF does THAT mean?

[Ransom @ Sep 14th 2006 4:15AM]

pbase, only idiots think that voting conspiracy is a partisan issue...

Go hang out on the loose change forums with your friends.

[Matt S @ Sep 14th 2006 4:25AM]

All OSes are susceptible to viruses, but WinCE3 is OLD. Like last century old. WinMo 5 is so much better. Heck, they could have used WinXP embedded, removed all the unnecessary components (thus fitting it into a few dozen megs), and made a much more secure system. Heck, I doubt virus writers are even targeting WinCE3 these days...
It might be that they're cheap and didn't want to pay for new licenses, since they already probably had the WinCE3 licenses sitting around...

[Lawrence Ricci @ Sep 24th 2006 5:50PM]

Just a note about Wince- Any software that does not support strong authentication is susceptible to inserted code- e.g. virus. This includes Linux, VXworks, UNIX, Palm, Symbian and QNX- all have had virus/worm attacks.

Some of these systems, including Windows CE, can and have been extended to include strong authentication. Diebold did not bother with this effort.

Interestingly, with more than 50,000,000 installed Windows CE and Pocket PC systems, there has not been even one example of a self-inserting virus in the wild.

Lawrence Ricci
www.EmbeddedInsider.com

[Shane @ Sep 14th 2006 4:25AM]

"pbase, only idiots think that voting conspiracy is a partisan issue..."

Ransom, only idiots forget Diebold's CEO, Wally O'Dell, said "I am committed to helping Ohio deliver its electoral votes to the president next year," in a fund-raising letter to Republicans dated August 13, 2003.

pbase is referring to a specific conspiracy theory that O'Dell's own letter lends credence to.
Certainly a hackable voting machine can potentially be abused by anyone - but only real idiots start calling people names when it's completely unnecessary.

[Russell @ Sep 14th 2006 4:53AM]

Yes, CE5 can be restricted to only run signed code... This attack could be quite easily mitigated by a signed code systems where the attacker's code would not have a valid signature/certificate so it would not execute, while the updates and normal software would.

It would be rather trivial to redesign this system to take advantage of the new security features of CE 5... And I would hope that this is done before the next election.


Then again, we found good old fashioned ballot boxes floating in the SF bay, so perhaps it is still more secure to go electronic...

[Jeff Lewis @ Sep 14th 2006 4:53AM]

"The Dieblod [sic] machines run Windows CE 3.0 -- so, they're susceptible to viruses."

WinCE is an embedded OS - same as used in older PocketPCs for which there are essentially no viruses. In any case, how exactly would the virus be delivered?

A much bigger problem is the lack of audit trails and inconsistent requirements for recounts that allowed some counties in the 2000 Florida vote to simply recheck the totals in memory as a 'recount'.

Then again, up here in Canada we use old fashioned simple "X in a circle" paper ballots and can get an election done and reported in hours of poll closing.

[netdroid9 @ Sep 14th 2006 6:04AM]

...Why can't we just whack an entire voting machine on a single, self-contained IC? Then we could solder that IC to the back of the screen and use a micro-switch to stop people from opening the machine? People'd notice a big hole in the back of the machine (presumably) and even if you got it open, you'd need lab equipment to actually open up and hack the IC. But there's still the possibility of attacking the touchscreen's bus... I suppose we could use an encrypted bus and decrypt the bus in another IC on the touchscreen, perhaps disguised as a rack of capacitators or something of the like...

...Or, we could just put cameras in the voting booths *facepalms*

[Intrepid @ Sep 14th 2006 6:34AM]

The only way it could be hacked is if the programmers were bery unintelligent. It's such a simple system, how could they getit wrong.
And don't blame the very outdated OS thats being used, Windows CE 5.0 (or soon to be realeased CE 6) are far superior but still Windows is not the problem.

[rav0 @ Sep 14th 2006 7:29AM]

In Australia, we do it the smart way every time. Ballot boxes. Plus, they're recyclable, don't we all love the environment?

[dejal @ Sep 14th 2006 7:39AM]

Nothing surprising here. After the manufacturer of these machines, with a nod and a wink, guaranteed the GOP a victory last November. What's amazing is that it took so long for someone to dissect one of these.

Huh? Last November?

I had to check and see if the above comment was made in 2005.

If you don't know what F...ing year the Presidential election took place in...

But, keep spewing.

Personally, I'm hoping the Red Sox can hold on to their
World Series crown from last year.

[Jeff @ Sep 14th 2006 7:51AM]

All I can say is I'm glad my state (New York) is smart enough to keep using the old mechanical voting machines. Is it coincidence that we voted Democratic in the last two presidential elections while the rest of the country went Republican? You decide!

But, while I'm happy my own state still uses traditional, unhackable voting means, obviously I'm directly affected by the systems used by the rest of the country. And I'm continuously disturbed by the track record of Diebold voting machines, which have just had one problem after another, along with a series of at best questionable comments by the company CEO, and a long series of emails that was released a while back showing the company intentionally disregarding security and purposely doing an end-run around laws designed to guarantee it. (Go back and look at California's battle with this company.)

[XServed @ Sep 14th 2006 8:18AM]

...And there has never been a problem with paper ballots?

[IWantTouchScreen @ Sep 14th 2006 8:37AM]

Dejal,

"In mid-August, Walden W. O'Dell, the chief executive of Diebold Inc., sat down at his computer to compose a letter inviting 100 wealthy and politically inclined friends to a Republican Party fund-raiser, to be held at his home in a suburb of Columbus, Ohio.

'I am committed to helping Ohio deliver its electoral votes to the president next year' "

Came from a New York Times article published in November 9, 2003:

http://www.nytimes.com/2003/11/09/business/yourmoney/09vote.html?ex=1383714000&en=4aaf05085122736c&ei=5007&partner=USERLAND

Yup, it really happened. And we still trust them to count our votes, after all this..

[xzavier @ Sep 14th 2006 9:56AM]

Way to go Shane!

Ransom you need to pick up some history book and start reading them about voting/conspiracy or conspiracy/voting or whatever you want to call it.

Also it is nice to hear your OPINION not FACT(S) on this issue, but when you EXPERIENCE it behind the scenes you do come to a conclusion that it is a CONSPIRACY, I think maybe you forgot to put the word THEORY behind conspiracy? Oh and btw when I was behind the scenes helping out in the 2000 presidential elections I got to see this... conspiracy in action! Sometimes it is sooo settle that you would hardly even notice it, and it is happing right in front of you like a MAGIC TRICK!

[Bob Roberts @ Sep 14th 2006 10:01AM]

Is there a comprehensive list available of all the places currently using the Diebold machines for real voting?

[John @ Sep 14th 2006 12:42PM]

The article has a very strange sentence:

"While no one's definitively proven that such a scenario has ever actually happened in real elections, vote-hacking remains a distinct possibility, given the state of our electronic voting equipment."

Then:

"Malicious code "can steal votes with little if any risk of detection.""

Not to mention that recounts are meaningless on this equipment.

If the voting process is either a) partly secluded from public view and/or 2) easily manipulated, its normally a safe asessment that there are cheating going on.

Further, the sentence in the article seems to ask for a higher burden of proof than is needed to put people to jail. If you accept less than catching someone redhanded or confessing the crime (which is complicated since the conspirators would be the ones making the machines, eg people with full access to the equipment that would offer no means to prove tampering once it happened, even with a confession ...!).

So if you accept say, election results so suspicious that it seems completely impossible for them to be legit, then the presidental election results from 04 in New Mexico broken down by voting equipment is a great example. Apparently people that used electronic equipment had no clue about who they wanted for president (while they knew who they wanted for every other office) on a rate not only the highest in the country but far beyond any plausible explanation but differences in how the manual and the electronic euipment registered votes ... The presidential election result was determined by less votes than what was missing between the electronically registered and anything like a normal election result. Don't take my word for it, go and check it out yourself.

What I would recommend though if you have any interest in these questions no matter what political side you are on is :

http://www.house.gov/judiciary_democrats/issues/issues/election.html

John Conyers report on the Ohio Election where the point is made that you would not need to change the votes a lot electronically if you just use the whole arsenal of means to manipulate the vote first, under and and after the tally. Its the only way to cheat in an election really, since each measure can be fough, defended, excused, even admitted as a fault without much risk. And since the media sucks at proportions you can make it seem like the opponent is equally dishonest, even if the amount of questionables on the two sides is 1 to a million.

There's written a "republican edition" of the Conyers report by a lot of Lawyers and I would recommend reading both, comparing what cases are actually documented and how strongly (the Conyers report consist largely of Sworn Testimony). I am afraid I am not able to locate it just now, but as far as I have seen there is only one report of the sorts so I'll make do with my recommendation to read it.



Even if you are what you could call the Machiavellian type of Republican, it shouldn't take a genious to understand that if one of two parties in a two party system gains absolute power it'll inevitably end up with not Big but Giant, Corrupt Government and the end of Freedoms as it did every time up through history. No better and clearer treatment of the question than in Machiavelli's own Discourses on Livy.

[itguy06 @ Sep 14th 2006 12:44PM]

"WinCE is an embedded OS - same as used in older PocketPCs for which there are essentially no viruses. In any case, how exactly would the virus be delivered?"

Google Windows CE Virus and you'll see it has plenty of viruses. Including the first virus to jump from desktop to handheld. Considering these machines need to talk to some computer or network to communicate votes, that's an area for infection.

Still a scary thought that this is running on Windows anything! You'd think that they could custom design a simple OS to do this easier/cheaper/faster than reling on some MS POS code.

[kevin @ Sep 15th 2006 2:24AM]

hey those are our tax dollars at work!

do you really want to pay someone to write a voting-specific OS when you could just use a universally perfect OS for free?


(in all seriousness though, having that comissioned, while dangerous, couldn't have been more expensive than all of those licenses. the problem with having a specific and bulletproof os specifically for voting is that it actually shows who people voted for)

[Voltaire @ Sep 15th 2006 5:44AM]

1. 80% of all votes in America are counted by only two companies: Diebold and ES&S.

www.onlinejournal.com/evoting/042804Landes/042804landes.html
en.wikipedia.org/wiki/Diebold

2. The vice-president of Diebold and the president of ES&S are brothers.

www.americanfreepress.net/html/private_company.html
www.onlinejournal.com/evoting/042804Landes/042804landes.html

3. There is no federal agency with regulatory authority or oversight of the U.S. voting machine industry.

www.commondreams.org/views02/0916-04.htm
www.onlinejournal.com/evoting/042804Landes/042804landes.html

4. The chairman and CEO of Diebold is a major Bush campaign organizer and donor who wrote in 2003 that he was "committed to helping Ohio deliver its electoral votes to the president next year."

www.cbsnews.com/stories/2004/07/28/sunday/main632436.shtml
www.wishtv.com/Global/story.asp?S=1647886

5. Republican Senator Chuck Hagel used to be chairman of ES&S. He became Senator based on votes counted by ES&S machines.

www.motherjones.com/commentary/columns/2004/03/03_200.html
www.onlinejournal.com/evoting/031004Fitrakis/031004fitrakis.html

6. Republican Senator Chuck Hagel, long-connected with the Bush family, was recently caught lying about his ownership of ES&S by the Senate Ethics Committee.

www.blackboxvoting.com/modules.php?name=News&file=article&sid=26
www.hillnews.com/news/012903/hagel.aspx
www.onlisareinsradar.com/archives/000896.php

7. Senator Chuck Hagel was on a short list of George W. Bush's vice-presidential candidates.

www.businessweek.com/2000/00_28/b3689130.htm
theindependent.com/stories/052700/new_hagel27.html

8. ES&S is the largest voting machine manufacturer in the U.S. and counts almost 60% of all U.S. votes.

www.essvote.com/HTML/about/about.html
www.onlinejournal.com/evoting/042804Landes/042804landes.html


9. Diebold's new touch screen voting machines have no paper trail of any votes. In other words, there is no way to verify that the data coming out of the machine is the same as what was legitimately put in by voters.

www.commondreams.org/views04/0225-05.htm
www.itworld.com/Tech/2987/041020evotestates/pfindex.html


10. Diebold also makes ATMs, checkout scanners, and ticket machines, all of which log each transaction and can generate a paper trail.

www.commondreams.org/views04/0225-05.htm
www.diebold.com/solutions/default.htm

11. Diebold is based in Ohio.

www.diebold.com/aboutus/ataglance/default.htm

12. Diebold employed 5 convicted felons as consultants and developers to help write the central compiler computer code that counted 50% of the votes in 30 states.

www.wired.com/news/evote/0,2645,61640,00.html
portland.indymedia.org/en/2004/10/301469.shtml

13. Jeff Dean was Senior Vice-President of Global Election Systems when it was bought by Diebold. Even though he had been convicted of 23 counts of felony theft in the first degree, Jeff Dean was retained as a consultant by Diebold and was largely responsible for programming the optical scanning software now used in most of the United States.

www.scoop.co.nz/mason/stories/HL0312/S00191.htm
www.chuckherrin.com/HackthevoteFAQ.htm#how
www.blackboxvoting.org/bbv_chapter-8.pdf

14. Diebold consultant Jeff Dean was convicted of planting back doors in his software and using a "high degree of sophistication" to evade detection over a period of 2 years.

www.chuckherrin.com/HackthevoteFAQ.htm#how
www.blackboxvoting.org/bbv_chapter-8.pdf

15. None of the international election observers were allowed in the polls in Ohio.

www.globalexchange.org/update/press/2638.html
www.enquirer.com/editions/2004/10/26/loc_elexoh.html

16. California banned the use of Diebold machines because the security was so bad. Despite Diebold's claims that the audit logs could not be hacked, a chimpanzee was able to do it! (See the movie here: http://blackboxvoting.org/baxter/baxterVPR.mov.)

wired.com/news/evote/0,2645,63298,00.html
www.msnbc.msn.com/id/4874190

17. 30% of all U.S. votes are carried out on unverifiable touch screen voting machines with no paper trail.

www.cbsnews.com/stories/2004/07/28/sunday/main632436.shtml

18. All -- not some -- but all the voting machine errors detected and reported in Florida went in favor of Bush or Republican candidates.

www.wired.com/news/evote/0,2645,65757,00.html
www.yuricareport.com/ElectionAftermath04/ThreeResearchStudiesBushIsOut.htm
www.rise4news.net/extravotes.html
www.ilcaonline.org/modules.php?op=modload&name=News&file=article&sid=950
www.scoop.co.nz/mason/stories/HL0411/S00227.htm

19. The governor of the state of Florida, Jeb Bush, is the President's brother.

www.tallahassee.com/mld/tallahassee/news/local/7628725.htm
www.washingtonpost.com/wp-dyn/articles/A10544-2004Oct29.html

20. Serious voting anomalies in Florida -- again always favoring Bush -- have been mathematically demonstrated and experts are recommending further investigation.

www.yuricareport.com/ElectionAftermath04/ThreeResearchStudiesBushIsOut.htm
www.computerworld.com/governmenttopics/government/policy/story/0,10801,97614,00.html
www.americanfreepress.net/html/tens_of_thousands.html
www.commondreams.org/headlines04/1106-30.htm
www.consortiumnews.com/2004/110904.html
uscountvotes.org/

[cvos @ Sep 18th 2006 9:50PM]

Er, nothing to see here, move along. The press has more important things to cover democracy with, like the Iraq war and stuff.

Yeah, a free Iraq will spread democracy to the world! Er, mental note, make sure to install plenty of Diebold voting machines in Baghdad.

[Troy @ Sep 18th 2006 10:01PM]

Damn Republicans and their high tech election cheating. Why can't they just cheat the old fashion way like Democrates. Vote early and vote often, smokes for votes...

[Russ @ Mar 31st 2007 7:37AM]

HBO's "Hacking Democracy" now released on DVD

See the film makers new website for details – http://www.hackingdemocracy.com

The controversial HBO documentary 'Hacking Democracy' DVD was released on March 27th, including extra footage never seen before.

Electronic voting machines count about 90% of the votes cast in America
today. Seattle grandmother Bev Harris did a simple Google search and stumbled across the trade secret software of the Diebold Corporation, which counts around 40% of America's votes. This treasure trove of information about the inner-workings of the company's voting system made its way to computer security expert Dr. Avi Rubin of Johns Hopkins University, who found "stunning stunning flaws".

Filmed over three years this exposé follows the investigations of a team of citizen activists from Black Box Voting as they take on the electronic voting industry, targeting the Diebold corporation.

The film reveals incendiary evidence from the dumpsters of Texas to the ballot boxes of Ohio, exposing secrecy, votes in the trash, hackable software and election officials rigging the presidential recount. And finally in Florida one brave election official gave Black Box Voting and the film makers access to his county's Diebold voting system, with dramatic consequences.

Ultimately proving the votes can be stolen without a trace "Hacking Democracy" culminates in the famous 'Hursti Hack', a duel between the Diebold voting machines and a computer hacker from Finland - with America's democracy at stake.